PT-2026-110033 · WordPress · Click5 Crm Add-On To Gravity Forms
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
click5 CRM add-on to Gravity Forms WordPress plugin versions prior to 1.0.4
Description
An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.
Recommendations
Update the click5 CRM add-on to Gravity Forms WordPress plugin to version 1.0.4 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Click5 Crm Add-On To Gravity Forms